Hunt: Microsoft's KQL queries, hashes and Defender detections for the trojanized Claude Code 2.1.312/2.1.313 extension from the Cursor marketplace

vendor threat intel (Microsoft Threat Intelligence, Oct 30)2026-10-30

Hunt: Microsoft's KQL queries, hashes and Defender detections for the trojanized Claude Code 2.1.312/2.1.313 extension from the Cursor marketplace

Microsoft Threat Intelligence analyzed the injected loader in the tampered anthropic.claude-code builds (2.1.312 and 2.1.313) served by the Cursor marketplace on Oct 29. It confirmed that the Visual Studio Marketplace and the official npm package were not affected. New details beyond Cursor's IOCs:

Recon: the loader sends the names (not values) of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP, plus hostname, user and global Git email.
Hashes: JavaScript entry point ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15; decoded tunnel private key 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278.
Windows: also check C:\ProgramData\ssh\administrators_authorized_keys; the SysMon task requests SYSTEM.
Defender names: Trojan:MacOS/SmtShellMal.A, Trojan:JS/CredTheft.MS!MTB, Trojan:MacOS/MalPlistSysmond.A, HackTool:MacOS/RevAnthShell.A.

Queries: DeviceNetworkEvents | where RemoteIP == "134.209.82.225"; DeviceFileEvents for the SHA-256 or file names .smt, .smtk, smt.cmd, smtk, sysmon.cmd, com.apple.sysmond.plist and the .stk_ prefix; DeviceEvents with ActionType ScheduledTaskCreated where AdditionalFields has both "SysMon" and "smt". ATT&CK: T1098.004, T1572, T1053.003, T1053.005.

Microsoft notes that a running tunnel or a file artifact alone doesn't prove the attacker got access. Preserve evidence before you clean up.

Sources: Microsoft Security Blog: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (Oct 30)